Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nixos/murmur: log to systemd journal, expose wrapper #50333

Closed
wants to merge 2 commits into from

Conversation

@florianjacob
Copy link
Contributor

florianjacob commented Nov 13, 2018

Motivation for this change

Everything I have on my server logs to systemd journal by default - except murmur.
This takes murmur in line with all other services by changing that.

On the very first start, murmur writes the password of the SuperUser into the log file.
To change this if desired or if that entry is not available anymore, this exposes a wrapper combining the binary and the service config file as the murmurd-service executable. (open to better naming propositions!).

As long as it's in the journal, the initial SuperUser password is now readable for all users in the journal group instead of root and murmur only. In case that group is not equal with the murmur administrators, the password can be changed with the new wrapper.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Fits CONTRIBUTING.md.

instead of /var/log/murmur/murmurd.log.
Achieved by having systemd run the daemon in foreground instead of
letting it fork to background.
@florianjacob
Copy link
Contributor Author

florianjacob commented Nov 14, 2018

@GrahamcOfBorg test mumble

@GrahamcOfBorg
Copy link

GrahamcOfBorg commented Nov 14, 2018

No attempt on aarch64-linux (full log)

The following builds were skipped because they don't evaluate on aarch64-linux: tests.mumble

Partial log (click to expand)

Cannot nix-instantiate `tests.mumble' because:
error: while evaluating 'recursiveUpdate' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:415:26, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:148:28:
while evaluating 'recursiveUpdateUntil' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:384:37, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:416:5:
while evaluating 'zipAttrsWith' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:347:21, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:394:8:
while evaluating 'zipAttrsWithNames' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:332:33, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/lib/attrsets.nix:347:27:
while evaluating the attribute 'mumble' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/nixos/tests/all-tests.nix:131:3:
while evaluating 'handleTest' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/nixos/tests/all-tests.nix:17:22, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/nixos/tests/all-tests.nix:131:12:
while evaluating 'discoverTests' at /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/nixos/tests/all-tests.nix:13:19, called from /var/lib/gc-of-borg/nix-test-rs-22/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/grahamc-aarch64-community-22/nixos/tests/all-tests.nix:18:5:
access to path '/nix/store/s6lni4rqrk98gdnzvdk7fvpwdf7c8y8d-grahamc-aarch64-community-22' is forbidden in restricted mode

@GrahamcOfBorg
Copy link

GrahamcOfBorg commented Nov 14, 2018

No attempt on x86_64-linux (full log)

The following builds were skipped because they don't evaluate on x86_64-linux: tests.mumble

Partial log (click to expand)

error: while evaluating 'recursiveUpdate' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:415:26, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:148:28:
while evaluating 'recursiveUpdateUntil' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:384:37, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:416:5:
while evaluating 'zipAttrsWith' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:347:21, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:394:8:
while evaluating 'zipAttrsWithNames' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:332:33, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:347:27:
while evaluating anonymous function at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/lists.nix:113:41, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/lib/attrsets.nix:347:46:
while evaluating the attribute 'mumble' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:131:3:
while evaluating 'handleTest' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:17:22, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:131:12:
while evaluating 'discoverTests' at /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:13:19, called from /var/lib/gc-of-borg/nix-root/repo/38dca4e3aa6bca43ea96d2fcc04e8229/builder/gleber-bastion/nixos/tests/all-tests.nix:18:5:
access to path '/nix/store/3c1anc9ihqklylkpgfn5kjk35vr1safy-gleber-bastion' is forbidden in restricted mode

@florianjacob
Copy link
Contributor Author

florianjacob commented Nov 14, 2018

Seems like I don't have the required permissions to run the tests through ofBorg, and when I try to run the tests locally I get a kernel panic, which does not seem to be related to the tests themselves, though. Probably issues with my nested virtualization setup or something.

@arianvp
Copy link
Member

arianvp commented Apr 10, 2019

@GrahamcOfBorg test mumble

Copy link
Contributor

aanderse left a comment

Feel free to completely ignore my request to remove PermissionsStartOnly = true;... but it would be super awesome if you added an extra commit doing so! 😄

@@ -251,19 +273,13 @@ in
after = [ "network-online.target "];

serviceConfig = {
Type = "forking";
Type = "simple";

This comment has been minimized.

Copy link
@aanderse

aanderse Apr 24, 2019

Contributor

Simple is the default type so this isn't actually necessary.

Restart = "always";
User = "murmur";
ExecStart = "${pkgs.murmur}/bin/murmurd -ini ${configFile}";
ExecStart = "${cli-wrapper}/bin/murmurd-service -fg";
PermissionsStartOnly = true;

This comment has been minimized.

Copy link
@aanderse

aanderse Apr 24, 2019

Contributor

I know #56265 isn't related to this PR at all... but would you be willing to do me a solid and remove PermissionsStartOnly = true; in an extra commit here? It looks like the only other things to do would be to add StateDirectory = "murmur"; and remove the call to createHome = true; and you would be good to go...

@xaverdh
Copy link
Contributor

xaverdh commented Apr 12, 2020

Since #38775 was merged, I guess this can be closed now?

@ajs124 ajs124 closed this May 22, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

6 participants
You can’t perform that action at this time.